Privacy Policy
TotalCRM is a product of Finbite (“Finbite”, “we”, “us”). This policy explains what information we collect, why, where it is kept, who it is shared with, and how you can have it deleted. It covers the TotalCRM website (totalcrm.in), the TotalCRM app, TotalCRM Cloud (team workspaces), the TotalCRM Android app, and the Facebook Lead Ads connection.
In short: we do not sell your data, we do not use your customers’ data for advertising, and we only use it to run TotalCRM for you. You can ask us to delete your data at any time by writing to hello@finbite.in.
Contents
- Who is responsible for what
- Information we collect
- Facebook Lead Ads data
- How we use information
- Who we share it with
- Where data is stored and for how long
- Security
- Your choices and rights
- How to delete your data
- Children
- Changes to this policy
- Contact us
1. Who is responsible for what
TotalCRM is used by businesses (“customers”) to manage their own leads and clients. Information about a business’s leads and customers belongs to that business: the business decides what to store and how to use it, and is responsible for having a lawful basis to contact those people. For that data, Finbite acts only as a service provider that stores and processes it on the business’s instructions.
For information about our own customers — such as account, purchase and licence details — and for visitors to our website, Finbite is responsible.
2. Information we collect
a) TotalCRM on your own device
In the device version of TotalCRM, the CRM data you enter (leads, customers, tasks, appointments, invoices, notes and settings) is stored in your browser or device storage and in backup files you choose to save. We do not receive or have access to this data.
b) Purchase and licence
- Details you give when you buy, such as your name, email address, phone number and order reference. Payments are processed by our payment provider; we do not receive or store your card or bank details.
- Licence information: your licence key, the devices it is activated on (a device identifier and device name you can see in the app) and when each device was last active, so that we can enforce the licence’s device limit.
c) TotalCRM Cloud (team workspaces)
- Account: your email address, the name you choose, and the workspaces you belong to and your role in them. You sign in with a one-time code sent to your email; we store only a scrambled (hashed) version of the code and of your sign-in session.
- Workspace data: the CRM data your team enters or imports (leads, activities, tasks, appointments, customers, invoices, templates and settings) is stored on our servers so that it is available on every device you and your team sign in on.
- Team invitations: the email address of anyone you invite, so that we can send them the invitation.
- Technical data: the device name you sign in from and when it was last used, and server logs (such as IP address and request time) kept briefly for security and troubleshooting.
d) Android app
If you allow notifications, the Android app schedules reminders for your appointments, tasks and follow-ups on your phone. Reminder preferences stay on the phone and are not sent to us.
e) Website
Our website uses the Meta Pixel, Google Tag Manager and Microsoft Clarity to measure visits and the performance of our advertising (for example, which pages are viewed and whether a purchase was completed). These services may set cookies and receive information such as your IP address, browser and device type. You can block them with your browser’s privacy settings or an ad blocker. The privacy and terms pages do not load these trackers.
3. Facebook Lead Ads data
TotalCRM Cloud can connect to Facebook so that leads from a business’s Facebook and Instagram lead forms arrive in its CRM automatically. This only happens when a workspace owner chooses Connect Facebook, logs in with Facebook, approves the requested permissions, and selects which Facebook Pages to connect.
What we access
- The list of Facebook Pages the person chooses to share with TotalCRM, and an access token for each Page they connect.
- The names and questions of the lead forms on those Pages.
- The leads submitted to those forms: the answers the person filled in (for example name, phone number, email and any custom questions), the submission time, and, when available, the campaign and ad name and whether it came from Facebook or Instagram.
How we use it
Only to add those leads to the connected TotalCRM workspace, show the form answers to that business’s team, avoid duplicate leads, and keep the connection working (for example, checking for new leads and showing the connection status). We do not use Facebook data for advertising, profiling, selling, or for any purpose other than providing TotalCRM to the business that connected it, and we do not combine it with data from other businesses.
Storage, retention and removal
- Page access tokens are stored encrypted on our servers and are used only by our server.
- Imported leads become part of the business’s workspace and are kept until the business deletes them or the workspace is deleted.
- When a Page is disconnected in TotalCRM, or when TotalCRM is removed from the Facebook account or Page (in Facebook’s Business Integrations settings), we stop receiving new leads and delete the stored access token and connection settings for that Page.
Our use of information received from Meta’s APIs follows the Meta Platform Terms and Developer Policies.
4. How we use information
- To provide TotalCRM: storing and syncing workspace data, signing you in, sending sign-in codes and team invitations, and importing leads you have connected.
- To manage purchases and licences, and to provide support when you contact us.
- To keep TotalCRM secure, prevent misuse, and fix problems.
- To send important messages about the service (for example, changes to these terms). We do not send marketing emails from TotalCRM Cloud without your permission.
- To understand and improve our website and advertising, as described in section 2(e).
5. Who we share it with
We do not sell personal information. We share it only with service providers that help us run TotalCRM, under agreements that limit their use of it to that purpose:
| Provider | What for |
|---|---|
| Cloudflare | Hosting the website and app, our servers and the TotalCRM Cloud database |
| Resend | Sending sign-in codes and team invitation emails |
| Meta (Facebook) | Facebook Lead Ads connection you choose to set up; website advertising measurement |
| Google, Microsoft | Website analytics (Google Tag Manager, Microsoft Clarity) |
| Our payment provider | Processing purchases |
Within a workspace, data is visible to the members of that workspace. We may also disclose information if required by law, or to protect the rights and safety of our users or the public.
6. Where data is stored and for how long
TotalCRM Cloud data is stored with Cloudflare, which may store and process it in data centres outside India. We keep:
- Workspace data for as long as the workspace exists. A workspace and all of its data are deleted when its last member deletes their account.
- Account data until you delete your account.
- Sign-in codes for 10 minutes, and sign-in sessions until you sign out or delete your account.
- Purchase and licence records for as long as needed to provide your licence and to meet accounting and tax obligations.
- Server logs only for a short period for security and troubleshooting.
7. Security
Data is sent over encrypted connections (HTTPS). Sign-in codes and session tokens are stored only in hashed form, Facebook Page tokens are encrypted, and access to a workspace is limited to its members. No system is perfectly secure, so please keep access to your email account safe, since it is used to sign in.
8. Your choices and rights
You can view, correct, export (Download backup) and delete your CRM data in the app at any time. You can also ask us to access, correct or delete the personal information we hold about you, or withdraw a consent you have given, by writing to hello@finbite.in. We will respond within 30 days. These rights include those under India’s Digital Personal Data Protection Act, 2023.
If you are a lead or customer of a business that uses TotalCRM, please contact that business first, as it controls your data. If you contact us, we will pass your request on to the business and help it respond.
9. How to delete your data
Delete your TotalCRM Cloud account: open TotalCRM, go to Settings → Workspace → Delete my account, and confirm. Your account is deleted immediately, together with any workspace where you are the only member and all of its data, including leads imported from Facebook.
Disconnect Facebook only: in TotalCRM, go to Settings → Facebook Lead Ads and choose Disconnect for the Page; or on Facebook, open Settings & privacy → Settings → Business Integrations, select TotalCRM and remove it. We then delete the stored access token and connection settings for that Page.
Delete Facebook lead data: delete the leads in TotalCRM, or ask us to do it.
Ask us: email hello@finbite.in with the subject “Data deletion request” and the email address or Facebook Page concerned. We will confirm when your data has been deleted, within 30 days.
10. Children
TotalCRM is a business tool and is not intended for anyone under 18. We do not knowingly collect personal information from children.
11. Changes to this policy
We may update this policy as TotalCRM changes. We will change the effective date above, and for important changes we will let account holders know by email or in the app before they take effect.
12. Contact us
Finbite — TotalCRM
Vadodara, Gujarat, India
Email: hello@finbite.in
See also our Terms of Service.